IOCReport

loading gif

Files

File Path
Type
Category
Malicious
idea-22543577.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$idea-22543577.xlsm
data
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61020 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DA3B3626.png
PNG image data, 1133 x 589, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\A8FE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\Cab2A1.tmp
Microsoft Cabinet archive data, 61020 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\Tar2A2.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jun 23 03:09:49 2021, atime=Wed Jun 23 03:09:49 2021, length=12288, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\idea-22543577.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Jun 23 03:09:49 2021, atime=Wed Jun 23 03:09:49 2021, length=93170, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\69FE0000
data
dropped
 clean
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\regsvr32.exe
regsvr32 ..\wail1.dll
 malicious
C:\Windows\System32\regsvr32.exe
regsvr32 ..\wail2.dll
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://servername/isapibackend.dll
unknown
 clean
http://investor.msn.com/
unknown
 clean
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
theottomandoner.com
5.100.155.169
 clean
senderoalcielo.com
108.167.165.249
 clean

IPs

IP
Domain
Country
Malicious
5.100.155.169
theottomandoner.com
United Kingdom
clean
108.167.165.249
senderoalcielo.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
>82
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF132
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF528
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF5E3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF67F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF71B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF7D6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF872
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF93D
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF9CA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ef2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FA3FD
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FA5F0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 113 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
146000
unkown
page read and write
 clean
A4000
heap private
page read and write
 clean
4A37000
unkown
page readonly
 clean
4850000
unkown
page readonly
 clean
45F9000
unkown
page readonly
 clean
3F40000
unkown
page readonly
 clean
4B0000
unkown
page read and write
 clean
7C0000
unkown
page readonly
 clean
3A60000
unkown
page readonly
 clean
42C2000
unkown
page readonly
 clean
146000
unkown
page read and write
 clean
4552000
unkown
page readonly
 clean
116000
unkown
page read and write
 clean
4358000
unkown
page readonly
 clean
4482000
unkown
page readonly
 clean
487000
unkown
page read and write
 clean
4612000
unkown
page readonly
 clean
4352000
unkown
page readonly
 clean
2430000
unkown
page readonly
 clean
45E5000
unkown
page readonly
 clean
4830000
unkown
page readonly
 clean
21A0000
unkown
page read and write
 clean
45A000
unkown
page read and write
 clean
146000
unkown
page read and write
 clean
4D4000
unkown
page read and write
 clean
EA000
unkown
page read and write
 clean
45C2000
unkown
page readonly
 clean
3FD0000
unkown
page readonly
 clean
1FF5000
heap private
page read and write
 clean
45E000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
45A6000
unkown
page readonly
 clean
269000
unkown
page read and write
 clean
4452000
unkown
page readonly
 clean
12D000
unkown
page read and write
 clean
4546000
unkown
page readonly
 clean
4552000
unkown
page readonly
 clean
4554000
unkown
page readonly
 clean
47B2000
unkown
page readonly
 clean
483000
unkown
page read and write
 clean
45B2000
unkown
page readonly
 clean
DA000
heap default
page read and write
 clean
48A0000
unkown
page readonly
 clean
164000
unkown
page read and write
 clean
20D000
heap default
page read and write
 clean
E0000
unkown
page read and write
 clean
270000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
4639000
unkown
page readonly
 clean
48E0000
unkown
page readonly
 clean
87000
heap default
page read and write
 clean
249000
unkown
page read and write
 clean
4595000
unkown
page readonly
 clean
1FF0000
heap private
page read and write
 clean
720000
unkown
page readonly
 clean
4582000
unkown
page readonly
 clean
12E000
unkown
page read and write
 clean
4534000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
46D5000
unkown
page readonly
 clean
4512000
unkown
page readonly
 clean
49E000
unkown
page read and write
 clean
42C8000
unkown
page readonly
 clean
44A000
heap default
page read and write
 clean
44A2000
unkown
page readonly
 clean
45C9000
unkown
page readonly
 clean
3E4000
heap private
page read and write
 clean
4532000
unkown
page readonly
 clean
4516000
unkown
page readonly
 clean
45A9000
unkown
page readonly
 clean
380000
unkown
page read and write
 clean
250000
unkown
page readonly
 clean
202B000
heap private
page read and write
 clean
1B0000
unkown
page readonly
 clean
3F7000
heap default
page read and write
 clean
45AD000
unkown
page readonly
 clean
4D9F000
unkown
page read and write
 clean
1A0000
unkown
page execute and read and write
 clean
3C0000
unkown
page write copy
 clean
4810000
unkown
page readonly
 clean
370000
unkown
page read and write
 clean
102000
unkown
page read and write
 clean
1D7000
heap default
page read and write
 clean
49D000
unkown
page read and write
 clean
140000
unkown
page read and write
 clean
2020000
unkown
page read and write
 clean
1D0000
heap default
page read and write
 clean
4B6000
unkown
page read and write
 clean
3EA5000
heap private
page read and write
 clean
1E0000
unkown
page readonly
 clean
117000
unkown
page read and write
 clean
3F35000
heap private
page read and write
 clean
180000
unkown
page read and write
 clean
70000
unkown
page readonly
 clean
4675000
unkown
page readonly
 clean
D3000
heap default
page read and write
 clean
44A4000
unkown
page readonly
 clean
134000
unkown
page read and write
 clean
44C4000
unkown
page readonly
 clean
4AC7000
unkown
page readonly
 clean
6DF000
unkown
page read and write
 clean
2065000
heap private
page read and write
 clean
3EA9000
heap private
page read and write
 clean
130000
unkown
page readonly
 clean
209B000
heap private
page read and write
 clean
4842000
unkown
page readonly
 clean
20E0000
unkown
page write copy
 clean
2F6000
unkown
page read and write
 clean
15D000
unkown
page read and write
 clean
4636000
unkown
page readonly
 clean
4645000
unkown
page readonly
 clean
24000
heap private
page read and write
 clean
1C0000
unkown
page write copy
 clean
20000
unkown
page readonly
 clean
6A0000
heap private
page read and write
 clean
4576000
unkown
page readonly
 clean
4522000
unkown
page readonly
 clean
1F40000
unkown
page readonly
 clean
4D6F000
unkown
page read and write
 clean
4A4000
unkown
page read and write
 clean
238000
heap default
page read and write
 clean
105000
unkown
page read and write
 clean
3A0000
unkown
page execute and read and write
 clean
15B000
unkown
page read and write
 clean
48E000
unkown
page read and write
 clean
443000
heap default
page read and write
 clean
4A2000
unkown
page read and write
 clean
4652000
unkown
page readonly
 clean
3FB0000
unkown
page readonly
 clean
3B0000
unkown
page readonly
 clean
3F0000
heap default
page read and write
 clean
4514000
unkown
page readonly
 clean
4625000
unkown
page readonly
 clean
4606000
unkown
page readonly
 clean
4582000
unkown
page readonly
 clean
A0000
heap private
page read and write
 clean
12D000
unkown
page read and write
 clean
3970000
unkown
page readonly
 clean
4880000
unkown
page readonly
 clean
45F2000
unkown
page readonly
 clean
4615000
unkown
page readonly
 clean
4B0000
unkown
page read and write
 clean
64F000
unkown
page read and write
 clean
1C40000
unkown
page readonly
 clean
105000
unkown
page read and write
 clean
216000
heap default
page read and write
 clean
BE000
heap default
page read and write
 clean
4689000
unkown
page readonly
 clean
80000
heap default
page read and write
 clean
3F39000
heap private
page read and write
 clean
146000
unkown
page read and write
 clean
4CB000
unkown
page read and write
 clean
3EA0000
heap private
page read and write
 clean
6A4000
heap private
page read and write
 clean
4D6000
unkown
page read and write
 clean
463D000
unkown
page readonly
 clean
4484000
unkown
page readonly
 clean
2070000
unkown
page readonly
 clean
47F0000
unkown
page readonly
 clean
472000
unkown
page read and write
 clean
46B9000
unkown
page readonly
 clean
47C000
unkown
page read and write
 clean
2D0000
unkown
page read and write
 clean
EE000
unkown
page read and write
 clean
4B6000
unkown
page read and write
 clean
4B6000
unkown
page read and write
 clean
43C2000
unkown
page readonly
 clean
2330000
unkown
page read and write
 clean
4505000
unkown
page readonly
 clean
48C0000
unkown
page readonly
 clean
45D6000
unkown
page readonly
 clean
3E0000
heap private
page read and write
 clean
2C0000
unkown
page read and write
 clean
42E000
heap default
page read and write
 clean
4B0000
unkown
page read and write
 clean
1CC0000
unkown
page readonly
 clean
4565000
unkown
page readonly
 clean
4682000
unkown
page readonly
 clean
45A6000
unkown
page readonly
 clean
132000
unkown
page read and write
 clean
2060000
heap private
page read and write
 clean
46B2000
unkown
page readonly
 clean
4F0000
unkown
page readonly
 clean
306000
unkown
page read and write
 clean
3F20000
unkown
page readonly
 clean
4B0000
unkown
page read and write
 clean
475000
unkown
page read and write
 clean
3F0000
unkown
page read and write
 clean
44C2000
unkown
page readonly
 clean
10C000
unkown
page read and write
 clean
44F2000
unkown
page readonly
 clean
140000
unkown
page read and write
 clean
4A0000
unkown
page read and write
 clean
45E2000
unkown
page readonly
 clean
4659000
unkown
page readonly
 clean
4535000
unkown
page readonly
 clean
4CD000
unkown
page read and write
 clean
4B6000
unkown
page read and write
 clean
5A0000
unkown
page readonly
 clean
670000
unkown
page readonly
 clean
70000
unkown
page read and write
 clean
2340000
unkown
page readonly
 clean
2150000
unkown
page write copy
 clean
494000
heap private
page read and write
 clean
490000
heap private
page read and write
 clean
46A5000
unkown
page readonly
 clean
45F5000
unkown
page readonly
 clean
4595000
unkown
page readonly
 clean
113000
unkown
page read and write
 clean
4622000
unkown
page readonly
 clean
4629000
unkown
page readonly
 clean
475000
unkown
page read and write
 clean
45C5000
unkown
page readonly
 clean
2A6000
unkown
page read and write
 clean
3F30000
heap private
page read and write
 clean
There are 205 hidden memdumps, click here to show them.